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ACCOUNTABILITY-BASED AUDITING AND REPORTING 


Introduction: The need for a coherent concept of comprehensive auditing and 
reporting 


The purpose of auditing is to serve an accountability relationship. The 
purpose of legislative auditing is to serve legislators’ scrutiny of the public purse, 
through audit reporting that increases their ability to hold government fairly to account. 
Without this enhancement of legislators’ capability, accountability is not likely to 
develop and endure. The work of legislative auditors should be coherent in its aim of 
serving the accountability relationship and meeting the needs of the governing body -- 
in most cases, the legislature. 


The purpose of this discussion paper is to propose a concept of 
auditing and reporting to meet the needs of governing bodies holding management 
fairly to account. For many readers, nothing suggested here will be new. It will 


simply bring existing views together in one paper. The paper deals with the following 
questions: 


e What do legislators need to Know most to hold government 
management fairly to account? 


e Who should be supplying the information? 


e What auditing and reporting approach best serves the accountability 
relationship between government management and the legislature? 


The concept of accountability suggests that the governing body is best 
served by knowing whether or not the most important management responsibilities 
have been satisfactorily discharged. The logical party to report on management's 
performance is management itself. Whether management reports or not, the audit 
report should deal with the most important accountability issues. 


By concentrating only on deficiencies to report, the auditor will not 
come to grips with accountability. Finding deficiencies takes only the effort to search; 
there will always be deficiencies in government operations. The important questions 
are: what are the most significant management responsibilities, and what is fair to 
expect management to achieve in the circumstances? The interrelationship of 
accountability, responsibility and due regard must be established clearly in each audit. 


The need for a coherent concept of auditing and reporting. We need a 
coherent concept of auditing and reporting -- for our credibility with audited 
management and legislators, and for the guidance of staff. The influence of an audit 
office is based on its professional legitimacy and expertise. The distinguishing 
characteristic of the professional is an intellectual technique acquired by special 
training and applied for the benefit of society. A rigorous concept of auditing and 
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reporting is therefore to be expected in legislative auditing. It needs to be a logical 
concept flowing from sound, specified assumptions, if it is to be viewed as 
consistently fair, expert and legitimate. Since legislators and members of other public 
sector governing bodies can’t carry out their own audits, they will be uneasy if they 
sense that comprehensive auditing is being offered without a sound conceptual 
underpinning. 


A sound concept of auditing and reporting is not something that deters 
initiative in the service of accountability. It’s needed to demonstrate to others that our 
audit objectives are clear and unbiased, to be used as a basis for assessing our 
effectiveness, and to provide staff with guidance that helps their ability and motivation. 


Some may feel that concepts are "theory’; that they don’t help with 
practical problems. Two observations apply to this view. The first, from within the 
auditing community, comes from the Executive Director of the Canadian 
Comprehensive Auditing Foundation (CCAF), J-P. Boisclair, wno has nearly 20 years’ 
experience going back to the beginnings of the OAG’s value-for-money auditing 
mandate. Based on his experience with what governing bodies expect of auditing, he 
has said on several occasions that, unless a sound concept of value for money 
auditing and reporting is developed by the audit community, the worth of VFM 
auditing in Canada may be severely challenged, and possibly “unravel”. 


The second observation goes back to the 1930s and 40s, and comes 
from Kurt Lewin, whose work with people in groups made him probably the most 
influential North American social psychoiogist of this century. As he put it, "There’s 
nothing as handy as a good theory." A good manager is always testing notions of 
better management; good auditors are always testing concepts of auditing and 
reporting, and applying what they learn. In fact, in making the more difficult 
professional decisions, accountants and auditors tend to turn for help to established 
"theory". 


The legislative auditor, to be considered a professional, should be 
applying a concept of auditing derived from sound reasoning. If, for example, it is 
maintained that legislation or other differences make the objectives and practice of 
value for money auditing in departments and agencies fundamentally different from 
VFM auditing in Crown corporations, the question is "How does the claimed difference 
actually make a difference that precludes a common concept of auditing and 
reporting?” 


The need for the concept to be useful. The first criterion for the 
usefulness of legislative auditing and reporting is that it must accommodate two broad 
situations. In one, management reports on its performance and the auditor reports on 
the fairness and completeness of management’s assertions. This is attestation 
auditing and reporting. In the other situation, management is not reporting on 
important aspects of performance and the external auditor. must then assess 
significant operations -- management’s most important responsibilities -- against fair 
criteria, and report the result. This is called direct performance assessment and 
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reporting, or direct reporting for short. The OAG work under Section 7 of the Auditor 


General Act has been this latter type of auditing and reporting, for reasons explained 
later. 


An auditor cannot attest if management makes no assertions. Part Ill of 
the federal government’s Estimates, the individual reports to the House of Commons 
by departments and agencies for their funding, is the most useful vehicle the 
government has for accountability reporting. But as accountability reports they are 
not yet adequate for attestation reporting by legislative auditors. And the nature and 
role of the government’s process called Increased Ministerial Authority and 
Accountability (IMAA) is not yet fully developed as a norm for accountability within 
government. But it is likely from the evidence, including the reporting approach used 
by Canada Mortgage and Housing Corporation for its first external VFM audit, that 
public sector managers increasingly will report on the discharge of their prime 
responsibilities and increasingly will see a strategic advantage to doing so. 


One troublesome point should be addressed at the outset. Some feel 
that, when we talk about the need for government managers to make more useful 
accountability assertions about their performance, we are in effect criticizing the 
adequacy of the external legislative auditor’s work in the direct reporting role. The fact 
is, when government management is not itself reporting, legislators need their auditor 
to ensure that they get at least some of the accountability information they need to 
scrutinize government operations adequately. The extent to which the external auditor 
has to assess and report management’s performance direct is inversely related to how 
completely and fairly management itself reports. This will be discussed later. 


In legislative auditing there are two different approaches to direct 
reporting. One approach views a “line of inquiry" or an “audit issue” as a probable 
finding of significant deficiency. It emphasizes the reporting of deficiencies. The other 
approach views the line of inquiry or audit issue as the question whether management 
met important criteria that were fair in the circumstances, and reports the auditor’s 
opinion, whether yes or no. This we can call accountability-based auditing and 
reporting. 


At issue in the deficiency approach is whether auditors and legislators 
will improve their understanding of accountability. The risk is that everything will 
remain a ritual dance of deficiency findings and partisan blaming in the legislature, 
with managers expected to show only enough "due regard" to avoid great 
embarrassment. In such a situation the legislature is simply an instrument in a 
process of assumed deterrence. Reporting only deficiencies does not increase the 
capability of legislators to hold fairly to account, and encourage them to become less 
partisan in their scrutiny of the public purse. 


The second view of auditing and reporting holds that real accountability, 
the cornerstone of the democratic process, is possible in government, and auditing 
should be designed to enhance it. We do this by understanding management's most 
important responsibilities in the accountability relationship, and reporting whether 
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management's assertions about its performance are fair and complete. It probably 
means that accountability doesn’t work properly until taxpayers direct their elected 
representatives to hold government management fairly to account and be held 
accountable for doing so. Or until some leading government managers, thinking that 
accountability is legitimate but sick of being seen by the public as motivated only by 
coercion, start to generate more useful reporting themselves. 


But this second view also holds that if government managers won’t 
report adequately, and are not asked to, the legislative auditor has a commonsense 
duty to identify and supply useful audit information to the legislature. In this case,. 
direct reporting is the auditor's assessment whether management met important 
criteria, so that the legislature can fairly judge performance rather than simply seek 
someone to blame for a discovered deficiency. There are no illusions about the 
problems with pursuing the second view, assuming as it does that fair accountability 
is possible to achieve. 


Even though auditors may set as their audit objective to determine 
whether management met the most important criteria, they may nonetheless tend to 
report only the deficiencies. There could be at least two reasons for this. First, it is 
less risky (and therefore easier) to report only deficiencies -- especially when they 
have been conceded by management. Second, the underlying reward system to 
which auditors respond can value deficiencies as audit findings that are more 
"newsworthy" (and therefore more praiseworthy). 


Auditing and reporting should each be dealt with separately in our work, 
until we can establish a unifying concept that clarifies what information legislators 
need most to hold fairly to account and, therefore, what should drive audit scoping. It 
is questionable whether one can carry out useful studies of audit methodology issues 
without a clear concept of the most useful reporting. 


Accountability-Based Audit and Reporting 


To repeat: if management reports on its performance, the external 
auditor attests to the fairness and completeness of the reporting. That is the essence 
of the professional auditor’s role in serving the accountability relationship and always 
has been. If we think management is not reporting adequately for accountability 
purposes we should point that out and say what we think is fair for the governing 
body to expect in reporting. But until management is asked to report adequately on 
its accountability we have to strive, within reasonable audit cost limits, to ensure that 
legislators get the minimum information they need on management’s discharge of its 
primary authorized responsibilities. 


Accountability-based auditing and reporting, whether attestation or 
direct reporting, includes the following characteristics: 
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a the auditor is serving the needs of a governing body holding 
management fairly to account; 


e the scope of the audit includes the critical success factors or functions 
central to management’s most important responsibilities; 


® the examination is scheduled so that available audit resources cover 
those management responsibilities in order of their importance; 


e for fairness to management and adequate clarity for the governing 
body, the management letter and audit report state the auditor’s 
opinion whether management has met criteria for due regard in 
discharging its most important responsibilities; and 


e the audit report includes observations on the adequacy of 
management’s accountability reporting to the governing body: what 
the auditor thinks is fair to expect management to report in the 
circumstances. 


lf accountability is needed for the most important responsibilities of 
management, deficiency reporting creates the problem so neatly captured in the 
expression “nothing said, all’s well".' Unless an audit report clearly conveys that 
prime responsibilities in which no deficiency is reported are satisfactory in all material 
respects, the governing body cannot tell whether they are deficient or not. An 
expectation gap is therefore possible. 


As legislative auditors, we should be using all the methods at our 
disposal to help create a climate of opinion that: 


e encourages management to account: to report adequately on the 
discharge of its most important responsibilities; 


* encourages governing bodies to exact the reporting if it is not 
forthcoming; and 


® encourages the public to hold governing bodies to account for 
achieving the reporting. 


Some may believe that promoting the idea of adequate reporting by 
government management is naive and a waste of time. Yet a moment's reflection 
forces the question: “How can promoting better public accountability be considered 
misplaced effort?" Emphasizing deficiencies may be easier, with a lower risk of error, 
and may attract more media attention as a reward. Yet encouraging better external 


' The author is indebted to Drs. Clemens N.J. van der Werf, R.A. for this succinct 
summary of the problem. 
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accounting by management is what is expected of all external auditors serving an 
accountability relationship. Another possible reason for emphasizing deficiencies is 
that we have not yet designed a coherent concept of auditing and reporting that 
specifically serves accountability. 


What can the legislative auditor do to ir-orove the service of auditing to 
accountability? It may be that not much needs to be cnanged in audit techniques as 
such; at issue is the lack of consensus on what audit reporting is to accomplish. A 
desire to report only deficiencies can slant the audit scope to a search for 
deficiencies, and not to encompassing management’s main responsibilities. If the 
auditor is striving to produce what the governing body needs most for holding fairly to 
account, audit staff need simply to start reporting that management met the most 
important fair performance criteria, when that is the case. As the Provincial Auditor of 
Ontario put it, in a meeting of the CCAF’s Reporting Study Steering Committee, "If 
you know it, why not report it?" The main message of the Macdonald Commission on 
the expectation gap between the public and the auditing profession was even 
stronger: what the auditor knows had better be reported. Those who argue that 
accountability-based reporting represents a prohibitive audit cost need to consider 
ranking management’s responsibilities subject to audit, rather than seeking increased 
audit resources. An important factor is audit assurance, and the degree of 
professional risk one is willing to undertake: the willingness to stand publicly behind 
an audit conclusion that management met an important criterion. 


This discussion paper will first set out underlying assumptions, and then 
propose a concept of auditing that specifically serves accountability between 
management and the governing body. 


Assumptions 
1. Accountability is the obligation to answer for a responsibility conferred. 


This is the well-known concept supplied by the 1975 Report of the 
Wilson Committee, an independent body chaired by the late J.R.M. Wilson, FCA, 
which examined the role of the Auditor General of Canada. It has been used 
consistently in the Office and in the Canadian auditing community, and has stood the 
test of time. "To answer’ means, universally, to report. Since holding to account 
means requiring an accounting, the accountable entity or organization that is not 
reporting on the discharge of its prime responsibilities is not answering, and therefore 
is not being held to account. Periodic external questioning based only on information 
from auditors may satisfy a particular interrogator’s wants, but does not hold to 
account in a manner that is comprehensive, fair, regular, systematic, reliable and 
durable. 
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me Auditing is a process superimposed on an accountability relationship. 


This important distinction between auditing and accountability also 
comes from the Wilson Committee Report. The auditor serves the relationship but 
stands outside it; it is not the auditor who holds management to account. The 
following is the definition of auditing set out in the CCAF’s 1991 study, 
Comprehensive Audit Reporting -- Concepts, Issues and Practices. 


Audit serves an accountability relationship. It is the independent, 
objective assessment of the fairness of management’s representations 
on performance or the assessment of management's systems and 
practices, against criteria, reported to a governing body or others with 
similar responsibilities* (p.32) 


This definition embraces both the attestation and direct reporting roles 
in legislative auditing. In the direct reporting role it encompasses deficiency-only 
reporting. In attestation auditing it covers the fairness and completeness of 
management’s accountability reporting, because reporting is itself an important 
dimension of management performance. 


3. Accountability comes before auditing 


Auditing can supply useful information about management of an entity 
or program but an audit report cannot be the answering that an accountability 
relationship demands. Without the answering there is no accountability. If external 
audit reports are viewed as a Satisfactory replacement for the accountable entity's own 
answering, effective accountability relationships will be truncated and won’t develop. 
During her chairmanship of the House of Commons Public Accounts Committee 
Aideen Nicholson said "You can’t manage by audit." Managers who are not asked to 
account are not made to feel accountable or to think about the strategic value to them 
of good external accounting. Managers’ concerns about accountability can then 
revert to the effects of audit report criticism, which means they may respond to the 


2 “Management representations” is the term used by the CCAF. To the average 
person it may seem less strong in connotation than statements one is prepared to 
stand behind -- assertions. A standard dictionary reference explains that to assert is 
to "state or put forward positively" with anticipation of a denial or objection. 
(Webster's New Collegiate) This fits with the use of “assertion” in rigorous writing 
such as in scientific journals. In the same dictionary the word “representation” is 
explained as being "an artistic likeness or image" or "a statement or account made to 
influence opinion or action’, as perhaps in advocacy for oneself or others but not 
necessarily impartiality. In the auditing profession the term used is management 
assertion. This author doesn’t believe in introducing a new term when the existing 
term “assertion", whether in English or French, conveys the message in the spirit of 
accountability] 
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external auditor’s agenda at the possible expense of their own. The better state is 
being motivated to account as a function of values internalized in the organization. 
And if auditing is a process superimposed on an accountability relationship, external 
accounting, by definition, comes before auditing. - 


Direct reporting is needed if management is not reporting. But it is 
easy for the legislative auditor who has been comfortable with that form of reporting to 
think that, for accountability purposes, the audit report suffices as an answering. Or 
that no better accounting by the accountable entity is needed, because the legislative 
auditor can supply the essential information to the governing body. This is a false 
assumption. Auditors’ knowledge of the organization is never as complete as 
management’s. Auditors do not always know the rationale for management's 
choices, and they do not know as well as management the actual constraints that 
define management’s "due regard", the degree of striving that is reasonable to expect 
in management’s circumstances. 


We have to keep in mind that there are limits to what external VFM 
auditing can do. All the auditor can supply, albeit with cumulative analysis and 
intuition, is a description based on a partial observation of operations, on samplings, 
on a review of documents and, especially in a VFM audit, on the results of interviews. 
These interviews are mostly with management and are vulnerable to what 
psychologists call the "socially desirable response’. 


4. The accountability relationship improves with 
® improved management disclosure (fairness and completeness); and 


e improved capability of the goveming body (clearer and fairer 
expectations of management, the intent to hold fairly to account and an 
ability to deal competently with that accounting). 


Improved disclosure by accountable management, including the 
rationale for important choices, should increase the trust of the governing body and 
the public in management. By the same token, management’s trust in the governing 
body, as the prime user of the accounting, should increase when management 
perceives competence and fairness in the governing body’s review. Audit reporting 
cannot control these variables, but it can help increase the competence of the 
governing body by: 


@ recommending what disclosure is fair to expect in the accountability 
relationship -- what management should be capable of reporting, in the 
auditor’s view; and 


e scoping in the management responsibilities and critical functions that 


the auditor thinks are most important for scrutiny by the governing 
body. Covering these responsibilities in the audit reports helps 


QAG Discussion Paper 64, April 1992 Personal views of the Author 


Accoumtability-Based Auditing and Reporting 


members of the governing body, especially those who are laypersons, 
to understand the central responsibilities and critical functions. 


+f The auditor needs to be able to explain clearly to the governing body: 


e the level of management responsibility to which the audit opinion 
relates — the level to which audit assurance is being taken, whether 
sub-activity, activity, entity or full program; 


e the rationale for the auditor's judgment that what he or she is reporting 
is significant to the decision making of the governing body; and 


e the audit criteria used, and why they are relevant and fair in the 
circumstances. 


The governing body, for whom the auditor works, is entitled to know the 
rationale for the auditor's choices about the conduct of the audit. It is also entitled to 
know what it is getting and not getting in the audit report. This is one of the 
messages in the CCAF’s 1991 Reporting Study. Expectation gaps occur when this 
isn’t provided. We have to remember that auditors are, themselves, open to 
assessment by knowledgeable members of the governing body. 


For example, in special examinations of Crown corporations, where the 
audit report is directed to the board of directors, the level of audit assurance is defined 
by statute to be the whole corporation. The audit scope and criteria are to be 
explained and justified to board members before the examination phase begins. The 
level of management responsibility is at the CEO level, or the whole corporation, 
because that is the level of reporting most useful to the board and, beyond the board, 
to the responsible minister and the House. This paper will not deal with the question 
of the level of audit assurance in reporting on government departments and programs, 
except to point out that legislative auditing has to contend with what legislators have 
to deal with: the whole of government’s programs. 


Because the auditor’s credibility in understanding the corporation and 
its objectives is a stake before the board, the explanation of scope and significance 
must be clear. Making the audit criteria clear defines the audit scope. But in audits of 
departments and agencies there is no equivalent “engagement meeting" with the audit 
client -- the House of Commons -- before the audit is launched. The client of the 
legislative audit and the ultimate client for the Crown corporation legislative audit is the 
legislature, not management. These facts have important implications for what the 
audit reports have to convey in explaining the degree and level of audit assurance, the 
rationale for significance and the disclosure of criteria. 


It is interesting to note that, of the issues raised thus far, only disclosure 
of audit criteria has been covered in the standards for reporting value for money 
audits as recommended by the Public Sector Accounting and Audit Committee of the 
Canadian Institute of Chartered Accountants. But on that issue the Committee is very 
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clear. PSAAC’s VFM Auditing Statement 4 recommends that the audit criteria be 
“clearly identifiable" in the auditor’s report. Thus any member of a governing body 
should be able to identify, without diffio:ity, what the auditor thinks are the most 
‘important criteria for management to »> at. 


Holding Fairty to Account 
Accountability, Responsibility and Due Regard 


To talk usefully about accountability, we have to first ask the central 
question: "accountability by whom, to whom, for what?" This was the question put by 
Donald Yeomans, as Chairman of the Value for Money Management Committee of the 
Society of Management Accountants of Canada, in that Committee’s mid-1980s 
deliberations on accountability. Asking "accountability for what?" forces the issue of 
what management is primarily accountable for achieving. Without identifying 
management’s paramount responsibilities, processes to achieve accountability are 
meaningless. If auditing is to serve accountability, the auditor has to identify those 
responsibilities and, for each, the functions or sub-objectives critical to their discharge. 
It is a question of ranking them. 


The first accountability question is: which responsibilities are, or should 
be, of most concern to the governing body? The auditor has to know the extent to 
which there is a mutual understanding between management and the governing body 
on what constitutes management’s central responsibilities for achievernent. This 
agreement can be explicit or tacit, but if there is little that is evident the egislative 
auditor has to make some assumptions about what management is ex@ected to 
achieve and about its due regard to results and controls. Then comes the job of 
identifying what management should be reporting to the governing body and, 
therefore, what should be included in the audit scope. 


Accountability. Accountability and responsibility are related but 
separate concepts. The simplest definition of accountability remains that of the 
Wilson Committee; the obligation to answer for a responsibility conferred. Note that 
the Wilson Committee intended accountability to be public. By contrast, the recent 
Osbaldeston study viewed accountability by senior public servants as accountability 
only to someone within the Crown who has specifically conferred authority. 
Osbaldeston also proposed that “answerability" should be different from 
accountability, a proposal that could not make sense unless Wilson and his 
colleagues were wrong. It is asking too much of people to expect them to think that 
“answering" is different from providing an accounting. 


The essence of accountability is the disclosure of one’s rationale for 


important choices and of one’s own standard of performance for one’s perceived 
responsibilities, and the assertion that one has or has not met it. 
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Society holds managers publicly to account in various ways, for 
responsibilities beyond those specifically in a hierarchy of internal command. 
Environment is an obvious example, where public expectation for due regard and 
effective action will produce public accounting by management and managers. In the 
case of the Exxon Valdez, the media’s hounding of the ship’s captain was the first 
prominent demand for accountability after the spill, even though they had the wrong 


target: the ultimate responsibility for preventive systems to guard against such 
accidents lay at the board level. 


We will increasingly see public accountability demanded at each level of 
management involved in an action, to prevent a diffusion or avoidance of 
accountability. Robert Stanfield argued years ago, in the Nowland lectures, that the 
traditional notion of "ministerial responsibility" was impractical in a government setting 
that had become much more complex than when it was formulated as the answer to 
accountability. The relevant accountability is practical accountability to a governing 
body. If government officials go willingly before Public Accounts committees to 
answer questions such as "what do you intend to do about problem x, and by when?" 
they are being held to account by anyone’s terms. Deputy heads as well as the PAC 
have publicly stated that they see the relationship between them as one of 
accountability. To the extent that the process works it is because both recognize the 
legislature’s legitimate need to know how well an important government responsibility 
was discharged. As CMHC President George Anderson said at the 1989 conference 
of the CCAF, accountability has to be installed in the organization’s value system by 
leaders who personify it. 


Responsibility. Management’s responsibilities are the starting point for 
the auditor. The simplest meaning of responsibility in an organization is a 
performance obligation, a duty to accomplish something arising from what is basically 
an exchange or an implicit contract. One agrees to produce or strive for a valued 
outcome for the other party, at an understood level of ability and effort, in return for a 
valued outcome for one’s self or group or organization. Included in this is a 
dimension of common social responsibility undertaken by each party. The key 
elements in responsibility are fairness of expectations and willingness to accept the 
responsibility, which includes accounting for performance. We don't expect a person 
to do more than he or she is able to do against external constraints. For example, 
while the important thing is accomplishment -- an outcome -- we should not expect an 
individual to prevail against a motivation system that is powerful enough to be a 
significant external constraint. 


In the public sector there are many constraints on managers that have 
to be incorporated in the notion of fair responsibility, some of which have the effect of 
reducing ability or motivation or even the motivation to increase one’s ability. They 
include such factors as lack of adequate resources to meet the level of expectation, 
persistent poor direction (which can also be thought of as a limit on ability), 
dependency on others for work input, situations of shared responsibility, and 
ministerial override. Responsibility has to do with fair expectations; due regard has to 
do with the quality of management’s effort to meet them. 
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Due regard. Although it is not explained in the legislative auditing Acts 
that use the term, due regard means doing one’s best, in view of external constraints, 
to meet the spirit of a performance expectation. It means striving for or giving 


adequate attention to something. But there are three important aspects for the auditor 
to consider. 


First, external constraints have to be real constraints. The auditor has 
to guard against making the mistake of "exoneration". The usual example one sees in 
audit reports is this type of statement: 


“Management had poor internal controls. Because of this, senior 
management was unable to..." 


The fallacy is that senior management is portrayed by the auditor as in 
some way captive to an external constraint when, in fact, the quality of internal 
controls is within management’s control. 


Secondly, due regard applies to the quality of management’s coping 
with external constraints. An early VFM example will illustrate. In the first 
comprehensive audit of the Department of Indian Affairs and Northern Development in 
1979, a major audit observation was the unclear mandate of the Department. It could 
not alone determine its mandate yet the mandate was central to the Department’s 
achievement and accountability. What the Public Accounts Committee expected of 
the deputy head following its hearing on the report, and what he agreed to, was to 
have the Department undertake to be the lead agency in a collective effort to establish 


a clearer mandate. This was a stated intention of level of effort in coping with external 
constraints. 


Thirdly, due regard does not mean accomplishment beyond what can 
be expected in the circumstances. It means results, but those reasonably to be 
expected from the accountable entity, given the external constraints. It is a concept to 
do with the level of striving rather than with outcomes alone. This is because external 
constraints can influence the observed performance outcome. The father of causal 
attribution theory, Fritz Heider, used the example of a person rowing a boat in a river, 
against the current. If the person makes no headway in relation to the land, is it 


because of poor rowing ability or lack of effort? Or is it simply because the current is 
too swift? 


Due regard means the actual accomplishment when the chain of 
determinants producing results is within management's control. For example, the 
quality of the outputs of a government service department used exclusively by other 
government divisions can be said to be within the control of government as a whole. 
We can therefore assess its effectiveness within government, to the extent that the 
result is not affected by external constraints on government itself. But the 
performance outcomes of the service department may not be fully within that 
department’s management control. Therefore, government can be held to account 
fully for the department’s performance, but the department only for due regard. If 
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results are hard to measure, the attributes of a reasonable level of striving can be 


identified and used as surrogates of performance, combined with the impressions of 
beneficiary grcups. 


A level of striving reasonable to expect is itself a result, if expressed as 
a Standard. The point to remember in thinking of due regard is that “expected results" 
have to be defined carefully and fairly in the circumstances. It is, in effect, a 
contractual obligation, but it may be tacit. 


Management's Obligation to Report 


lf management is not accounting for its performance, it is not being 
held to account. The reporting can be on results achieved, as in private sector 
corporate financial reporting where sustained cash generation is the corporate 
objective. Or it can be on management’s striving, including choices and the reasons 
for them. Or the reporting can be on both of these. 


In the public sector the quality of governments’ accounting to 
legislatures has been given much attention in recent years by all auditors general, 
provincial and federal. One problem is that organizations will tend not to account 
externally unless they are asked to or see strategic advantage in doing so, even 
though they recognize the legitimacy of their being held to account. Since 
organizations tend to seek to control their environments rather than be controlled by 
them, managers may tend to see being held to account as likely to increase external 
control over their decision making. On the other hand, they may see good external 
accounting as not only a legitimate obligation but also a strategic means of gaining 
greater control over their environments. 


By being seen as more responsible, managers may gain more 
resources. Public sector managers who don’t account for their intended and actual 
performance may not have thought through the strategic benefit. But then again they 
may have; they may feel that it is a lose-lose proposition. The more extensive their 
external accounting the more (if others aren’t accounting also) they will be the ones 
put in a goldfish bowl. Their reporting may be put to unfair use by media and 
politicians "looking for ink". 


The more important problem in the public sector, in view of the 
legitimacy of accountability, is the lack of a legislative requirement -- whether in 
general Acts or as accountability sections of enabling Acts -- for management to 
account adequately for performance. In the private sector it is the investing 
marketplace’s collective resources and knowledge that give it the power to influence 
corporate performance. The financial institutions don’t hold to account: they simply 
assesses performance direct and decide. The annual financial statements are the 
back-up to this tactical knowledge. But in the public sector there is no effective 
counterpart for assessing performance of government organizations, most of whose 
operations are not in a market environment. Crown corporations can be in a market 
environment but they are created to pursue public policy objectives. Even in the 
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private sector, however, there is a decreasing reliance on the conventional annual 
financial statements and an increasing use of enhanced reporting (Such as 
Management Discussion and Analysis reports, and special-issue reports such as 
environmental impact reports) to augment the traditional financial reporting and 
accounting conventions. 


When legislative VFM audit mandates in Canada were introduced in the 
late 1970s, there was no parallel requirement installed in financial administration Acts 
across the country for government management to report on its performance beyond 
the existing governmental financial statements. 


However, in Part X of the federal Financial Administration Act (FAA) 
governing Crown corporations, which came into force in 1984, there has been a start. 
Section 131 directs the corporation to have the systems and practices necessary to 
give "reasonable assurance" of economy, efficiency and effectiveness. Section 150 
provides for management to report annually the extent to which the corporation met 
its objectives for the financial year, opening the way for performance accounting 
beyond financial performance. But as yet there is no statutory requirement for Crown 
corporation managements to report that their management controls produce the 
reasonable assurance specifically required by the Act. 


The 1987 study by the CCAF on the reporting and auditing of 
effectiveness argues that it is management who should report on its performance 
rather than the auditor. Put simply, if the external auditor is reporting on 
management’s performance, as is the case in direct reporting, the auditor is doing 
management's job, and management is not being held to account. 


It would take only a short amendment to each financial administration 
Act across the country to require departmental and Crown corporation managements 
to report on the extent to which they have met their performance responsibilities set 
by legislation, and on the quality of internal management controls. Appropriate 
sections in the enabling Acts setting up programs are a strong statutory means of 
producing the reporting tailored to the specific accountability needed for those 
programs. The FAAs can set the general standards, but each program’s enabling 
Act, as reviewed by the related legislative committee, could set the type of 
accountability reporting specifically needed for that program. The legislation may cite 
an agency, but the funding is for a program. Management’s accountability reporting 
on programs should be made a scope area of the legislative auditor's program audit. 
In the case of federal Part Ill Estimates, the quality of management’s accountability 
reporting is set out as a Treasury Board directive, which depends on the collective will 
and power of the Treasury Board. They are not yet based in legislation. After nearly 
ten years, the Part lils are still inadequate as accountability reporting documents for 
the House of Commons. 
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Management Control: the Unifying Framework 


We need to examine how best to look at management control 
processes So we can produce the most useful approach to auditing. Managers often 
complain that auditors are not competent to express opinions on management. It 
doesn’t matter what auditors think of managers in the Public Service; the issue is 
whether auditors know enough about management control processes (which 
incorporate more influences than the formalized control systems) to be as useful in 
our reporting to governing bodies as we should be. It is a legitimate question, for 
example, whether we understand the interrelationship of main determinants of 
performance outcomes in complex organizations. Misconceptions about “systems vs. 
results" are but one example, which will be discussed later. 


We must remember that it’s risky for public service managers and 
ministers to publicly challenge the competence of the legislative audit office: the 
public view will be stacked against them because the public, not feeling able to hold 
to account, sees the auditor general -- provincial or federal -- as the only check on 
government operations. Not having been challenged is no support for thinking that 
our present level of understanding of management processes is adequate. We should 
understand contemporary views of management control processes so that we are as 
disciplined in them as the state of the art allows us to be. We have to start 
somewhere and the sources of frameworks to consider should be as authoritative and 
useful as possible. But not everything "authoritative" is useful across a range of 
situations just because it is "authoritative". Financial accounting principles are an 
example. In essence, management control is “causing to happen". Management 


control processes are those processes purposefully engaged to ensure that planned 
achievement happens. 


One source of views on management control with considerable stature 
is Robert Anthony of Harvard, generally acknowledged to be the dean of writers on 
management control and whose texts have been cited and used more often than any 
others. Anthony divides the management control process into strategic planning, 
management control and task control. Corporate management sets the direction and 
goals, then controls the accomplishment at the levels of management contro! and 
day-to-day operating control. Anthony makes it clear that the essence of 
management control is the management motivation system.° 


Because the role of public service management is executing policy, we 
can equate strategic planning to the setting of program policy. But we could also 
think of it as applying to the execution of policy, in the sense of planning the nature, 
level and direction of administrative effort from executive options within the legislative 


° The latest edition of Management Control, authored by Anthony, Dearden and 
Govindarajan, replaces “operational control" with the term "task control" and takes an 
even stronger stance that the formal management control systems, whether financial 
or non-financial, are only part of the processes producing performance outcomes. 
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funding. In terms of Peter Drucker’s distinction between doing the right thing and 
doing it the right way, management control deals with how one carries out the 
strategically right thing to do. Legislation may sometimes have something to say 
about the type and quality of ms: agement controls. If due regard is the quality of 
management's striving to safe’..2rd resources, comply with authorities and produce 
value for money in the executcn of policy, we are talking about the quality of 
management control. 


Interpreting the classic management by objectives approach and other 
"results-based systems", one can erroneously concentrate on "results" to the exclusion 
of the motivation systems and external constraints from higher authority that may 
stand in the way of actual achievement, or help sustain it. It is undoubtedly useful to 
focus on a few key results to keep things simple. But to be credible in discussing 
results one cannot exclude accountability and management motivation, and the latter 
isn’t simple to deal with. The CCAF’s 1983 booklet Knowledge Requirements stressed 
the need for the comprehensive auditor to understand and be able to assess 
organizational effectiveness. What this meant was understanding not only what 
constitutes achievement but also the effectiveness of organizational structure and 
process. One cannot build a concept of organizational accountability without a sound 
concept of management control, which is to say motivation and cause and effect. 

This has yet to be sorted out in the federal work on Public Service 2000, for example. 


The legislative auditor is expected to advise on accountability 
processes. Soon it will be insufficient for legislative auditors to be saying only: "X 
happened and Y didn’t". We will have to be able to suggest why X happened and 
why Y didn’t. As the then Chairman of the federal Public Accounts Committee, 
Aideen Nicholson, said after the hearings some years ago on the New Brunswick 
motel debacle, "The more important issue is: why did it happen?" To understand 
control over something, we need to understand what causes the observed results. 
What would happen if a PAC were to ask the legislative auditor specifically to 
determine and report underlying causes of strengths and deficiencies? 


Basic determinants of performance that the auditor needs to 
understand include ability, motivation, organization structure, information and external 
constraints. Other variables can be said to be derived from these basic determinants. 
Even information (as something managed for strategy and control) and organization 
structure (regularized patterns of interaction) can be said to be a function of the other 
three, but in large complex organizations they are important enough in their own right 
to be considered basic determinants. These and other variables combine in some 
way, in each situation, to produce the observed performance. The quality of these 
basic determinants of performance is a prime responsibility of management. Yet in 
our audits we do "ot assess at a knowledgeable level the appropriateness of 
organizational str: ture, the management of information or external constraints, and 
we have not yet schooled ourselves to deal with managerial ability and motivation. 


Thus our audit reports tend to remain at the symptom level than at the level of 
underlying cause. 
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As audited management in the future increasingly reports on its 
performance in more fundamental and specific ways, and as governing bodies 
increasingly ask for more useful information on which to base their decisions, external 
audit staff unschooled in management control will be unable to tell whether 
management's assertions are fair and complete. 


For example, how would legislative auditors deal with a Crown 
corporation management assertion that its motivation systems and organization 
Structure are satisfactory? The systems and practices requirements of FAA 
Section 131 embrace all systems and practices in aid of value for money. Another 
example is the federal government’s IMAA process. Without a sound understanding 
of cause and effect in management control, could an audit office assess, at an audit 
level of rigour, whether such endeavours are likely to produce a net benefit to the 
public purse, and why? 


Even when management control is seen mainly as an issue of 
motivation, assessing the adequacy of management control processes can’t be 
treated with mystique, to be done only by functional experts. It has to be within the 
capability of each audit team because management control determines due regard in 
all regular audit scope areas. Audit staff simply looking for deficiencies to report will 
not be led to an understanding of management control, because they will not be 
looking at the control processes that produce good results. Nor will they likely be 
examining what some writers on management control call the "illusions" that attach to 
the more mechanistic notions of control. Another education issue is the need to 
understand that traditional financial "internal control systems" are sub-sets of 
management control systems. 


As to the link between management control and financial attest audit, 
the CICA’s developing standards for internal control assessment will require a 
significant strengthening of the auditor’s understanding of internal contro! cause and 
effect and the "control environment". The characteristics of the control environment 
indicate management's level of effort and commitment to good internal control, which 
embraces policies as well as procedures needed to carry out the entity’s business. 
This implies that the auditor must understand the total process of control in 
organizations, ironically coming full circle to fit the initial 1940s definition of internal 
control by the American Institute of Certified Public Accountants. 


An important part of useful audit scope, not raised yet in discussion on 
legislative auditing objectives, is the set of factors that maintain systems and practices 
at a high level of due regard. For example, if a CMHC is judged by peers to be well 
run, what does it take to keep it that way? As well as leadership, what are the critical 
management control processes? This question is perhaps more important in the long 
run than delving into particular loss or waste. If we seek deficiencies only, we will 
never address this issue. 
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Systems-Based vs Results-Based Assessment 


"Results-based" is meant to apply to audit findings of specific, often 
quantified outcomes of specific actions and events related to programs or functions, 
as opposed to findings on the quality of the control processes responsible for 
outcomes. One example is finding more Coast Guard vessels steaming around than 
the auditor deems necessary to perform the assigned responsibility. If the audit report 
had said only that control systems were loose enough to allow waste such as too 
many ships or, at the ship level, that existing controls would not prevent inefficient 
deployment of crew time, the audit report would probably not have been dealt with by 
a legislature committee. 


The question is whether "results-based" is something that should be 
substituted for "systems-based", or whether they are complementary parts of sound 
audit assessment and are inseparable. Management control processes ensure the 
attainment of results. The question is decided by the objective of the audit. If the 
objective were only to produce instances of deficiencies, then reporting an important 
contro! system as weak and explaining why it had to be fixed would not be the 
message. 


Audit reports need to go beyond specific results and point the way to 
what a Public Accounts committee can do to deal with the underlying causes. We 
should anticipate the legitimate PAC question, “what do you suggest we do?" In the 
case of the Exxon Valdez, for example, the press hounded a sick captain. Who asked 
what allowed that situation in such a ship? Why aren’t there co-pilots, as in aircraft? 
What was the management control at the vice-presidential, CEO and board level? If 
management concedes the validity of a deficiency finding, the PAC still needs to ask 
why the waste occurred or is occurring still. The answer is the underlying 
management control processes, the motivational parts of which are key to predicting 
future performance. 


An event of waste is a sunk cost. The important issue is how to 
prevent others, and that is a control quality issue that involves assessing abilities, 
motivation, organization structure, information and external constraints. As every 
seasoned auditor knows, a good track record of results can end suddenly with the 
departure of a key person, which significantly alters processes. And a needed state of 
organizational readiness, as in emergency preparedness or military readiness, is a 
function of management control as well as resources. 


In public sector auditing, reporting an instance without an understood 
and conveyed relationship to the total cause-effect system will do little to advance the 
quality of accountability relationships, unless the audit client is totally knowledgeable 
about the whole system. Legislators will not be, nor will most boards or other 
governing bodies. The problem of talking only about "results" is that the auditor who 
isn’t knowledgeable about management control can be led away from investigating 
why particular results occur and the variables that need to be taken into account in 
trying to predict results. This makes the auditor less useful to the governing body. 
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The complementary relationship of systems assessment and outcome 
findings was described as early as 1979 in the OAG’s chapter on the comprehensive 
audit of the Department of Public Works, in setting out the role of the project audits: 


“The objectives of these project audits were to: 
verify that the systems and processes operated as planned; 
assess the significance of systems deficiencies; and 
illustrate the impact of serious deficiencies." 


lf the auditor’s concern is simply to lay before the governing body an 
instance of deficiency, reporting only specific outcomes will be sufficient. The main 
purpose of assessing a specific outcome is to determine if something has to be done 
to the underlying control processes. This should be the real concern about due 
regard: predicting future performance by those held to account. If the observed 
outcomes are ‘satisfactory’ how can the auditor tell whether they are apt to continue, 
without assessing the durability of the control? Furthermore, any specific outcome, 
taken only by itself, can be the result of factors beyond a manager’s control such as 
ministerial override, work inter-dependencies or a number of others. We need to 
know more than just what the deficiency is. 


The real question for the legislative auditor is how to shed light on the 
underlying causes of performance outcomes. This understanding is needed to have 
the corrective and preventive action taken that can be expected to make an enduring 
difference. And that means we are talking about management control processes. 
The trick is to describe it well enough in audit reports so that it is not regarded by the 
governing body simply as a "systems think piece". Leaving legislators with a finding 
of only an instance, however important, leaves them in the dark about causes -- 
unless the underlying causes and how to fix them are perfectly obvious. Auditors 
must also understand systems holistically rather than simply the parts. The most 
obvious example of failure to do this in the auditing profession is the continuing 
impression that financial control systems are something different from management 
control systems. Government’s accounting should reflect outcomes of management 
control systems as well as outcomes of fiscal and monetary policy. 


Thus far we have been dealing with the auditor’s understanding of 
management control because of the need to report on due regard. Yet the quality of 
management control is the responsibility of management, not the auditor. Therefore, 
it is management that should report on it. This raises the next question: “what is 
government responsible for achieving in its programs?" 


Accountability for Programs vs Entities: Which is the More Important Focus? 


The responsibility of the Crown is not to perpetuate separate 
organizational entities; it is to deliver effective programs. Since the programs need 
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delivery and administrative support structures, the collective organizational frameworks 
represented by departments and agencies provide them. The question is whether, as 
entities of accountability, programs are more important to legislators making decisions 
than the administrative structures. The funding from Parliament is for programs, not 
administrative entities. 


It is time to debate rigorously whether the traditional audit scope areas 
-- departments, ministries and agencies of government -- are the sensible primary 
boundaries of examination where one department is not synonymous with the whole 
program. In private sector auditing the orientation is to cluster audit partners and their 
staffs around different types of industries. The public sector counterpart is the 
program. One of the reasons for concentrating on the departmental boundary for 
audit scope has been that it is convenient: a department has an single management 
structure and a deputy head who is identifiable and accountable. It also simplifies the 
organization of audit groups by lessening the need for matrix management. But this 
leaves undealt with the problem of shared accountability for program accomplishment 
across departments. Environmental protection is a major example. The concept of 
sustainability broadens the responsibilities involved even more. 


This is not an issue in the standard government-wide audits. We have 
always understood that some cross-government management functions need to be 
audited at a government-wide level. This is because a risk pattern has been identified 
across two or more departments that we think justifies government-wide audit 
investigation for the House. We have to assess whether a cross-government function, 
deemed critical to due regard in a ranking of risk to the public purse across 
government, is being properly handled. In these situations, the cause of a cross- 
department problem usually lies with one or more lead agencies or central agencies, 
or its correction does, or both. 


The job of the Public Service is to execute the administration of the 
Crown’s policy. This means that due regard for compliance with authorities and value 
for money applies more to the achievement of the program policy objectives than to 
the organization structures called departments or agencies. We need to remember 
that a program stemming from policy is a government program, not simply an aspect 
of one entity’s operations. Therefore the legislative auditor’s concern should be 
identifying due regard to compliance with direction, VFM and accountability reporting 
for the program. This includes the necessary functional support, which may lie in one 
department or involve several. What we are talking about is management control at 
the government level. 


The legislature is responsible for overseeing the whole of government. 
The legislative auditor’s scope is, therefore, the whole of government. The question 
for an audit office is whether the ranking of government’s most important 
responsibilities, for audit attention and therefore audit resource deployment, should 
cover the set of government programs existing or currently being set up, rather than 
management responsibilities within departments. One reason why annual financial 
statements are limited as performance statements at the summary level is that the 
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reporting cycle is not geared to the logical performance cycles of programs. It is an 
annual slice across everything. The same is true of VFM program audits in 
departments by time cycle as opposed to program cycle. 


The issue is not what a particular department is responsible for so 
much as what the government is responsible for, in whatever discernible order of 
government priority, and what the government’s controls are across government to 
ensure that program objectives are met. No one doubts that it is easier to audit 
management control in a department than in the government. But so long as the 
audit focus is first on a department, we may not be ranking government’s most 
important responsibilities in the most sensible way and at the level most useful to the 
legislature. And we won’t get at the problems of purposefully diffused or shared 
responsibility and accountability as well as we should. 


By placing the audit attention on programs and on due regard by 
government with respect to programs, we can deal head on with the issue of shared 
responsibility and accountability and who in government is ultimately accountable -- 
including the central agencies. With auditing oriented to the departments and 
agencies, tracking shared accountability into another audited entity will not necessarily 
receive high priority by the senior auditor of that other entity, who will have in mind a 
ranking of matters of significance to that entity alone. 


In the case of responsibilities for a major federal government program 
such as environmental sustainability, one department typically has the lead agency 
responsibility but the effective carrying-out of the policy intent is shared among many. 
The minister and deputy head of a single department cannot.be held accountable for 
the whole program across government. In fact the needed program effort may be 
carried out in part, or even largely, by the provinces. The lead agency counterpart in 
the audit office would be the audit team designated as responsible for the program 
audit, who would set the audit objectives from an understanding of government's 
responsibility and accountability. This would include identifying, with the other teams, 
the responsibilities of the various government departments involved and what 
constitutes collective due regard. But the government does have an identifiable set of 
responsibilities at the government level. 


For example, the lead department of government may operate under a 
policy directive covering responsibilities for all departments, which works until the 
intended program results asserted by the lead agency fall into conflict with the existing 
political priorities of other departments, their budgets, autonomy aspirations or 
perceived jurisdictions. As someone said, "Energy creates the holes and Environment 
tries to fill them". The program audit team would be accountable for assessing the 
extent to which these occurrences hamper compliance and the achievement of due 
regard by government. The team would also have to be able to assess where the 
main compliance and accountability problems were in the shared responsibility, how 
serious they were and what caused them. 
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Yet another key program issue is the effect of one program on another, 
such as regional spending policies added to particular intended program results, or 
aims of an environment program clashing with energy claims. This creates 
accountability problems that have to be addressed at the government level, not at the 
level of a single department. In the seldom discussed issues of revenue and its audit, 
the focus of concern is a government revenue program, not a department 
responsibility. The same is largely true for effects of government regulatory agencies. 


In government accountability the language is important, as George 
Orwell made so clear. We need to look askance at anaesthetizing words like 
"partnership", when used to describe situations of joint accountability without 
mentioning the accounting needed. They can be accountability-avoiding words as 
much as positive-action words. But their use is related to the practice of describing as 
an "initiative" a remedial action that is simply one’s duty. Another example is 
describing intended accomplishment simply as "products", thereby preventing 


accountability by failing to state what the accomplishment is actually to be, and to 
what standard. 


The situation of accountability for departments and agencies is 
analogous to accountability for VFM in federal Crown corporations. The corporate 
board wants the view of the special examiner at the highest level of corporate 
responsibility, the corporation as a whole. That is the decision level at which the 
board is operating. So too, in the case of departments and agencies. It is much 
harder for MPs to get their arms around the whole of government spending (although 
some corporation board members will also feel inadequate to some degree about the 
corporation) but the whole of government is the level of the MPs’ responsibility. 
Therefore the level of reporting should reflect it. The business of government is 


running programs -- their execution and their financing -- not running departments as 
institutions. 


In cases where programs and departments are not synonymous, 
aligning audit to programs rather than departments will certainly involve adjustments in 
the audit office. But the important consideration is that these are internal audit office 
adjustments. This paper does not attempt to deal with what they should be. If the 
program audit will serve legislators better in holding government to account, then it is 
up to an audit office to structure itself internally to deliver the required professional 
service. Service to the legislature has to come before internal convenience. 


For credibility, the guiding concept underlying the Office’s scoping 
rationale should be visible, within the Office at the staff level, and externally. For 
example, with a fixed total audit budget what should be the effect on audit scope, and 
therefore on deployment of audit resources if the environment were to become the 
most important common accountability issue for all legislatures in Canada in the 
1990s? What is the effect of what the provinces do? Yet it may also be true that 
significant audit effort will be needed to report on how well large programs such as 
defence deal with VFM issues in shifting world conditions. 
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With a capped audit budget, the solution to necessary trade-offs is to 
rank them. The problem in ranking is that it always gores someone’s ox. Somebody, 
or each unit, has to give up an aspiration. But ranking is a common necessity in all 
organizations. The ranking is, first, to determine as best one can the relative 
importance of program responsibilities across government, taking into account 
legislative committee concerns. Then there are the risks: compliance, resource 
safeguarding, attention to VFM. Then there is accountability reporting. In one way or 
another the Crown’s objectives, and critical success factors and accountabilities have 
to be ranked for audit attention. From these assessments should flow the audit 
Office’s logical audit scope and internal administrative arrangements. 


In any organization, the commitment has to be to put the decision 
needs of the client governing body ahead of staff members’ comfort zones. This is 
the basis of "TQM". Sound scoping has to come from an understanding of the 
government-wide interrelationship of programs and accountability, and the 
administrative support needed, given the policy direction and concern for achieved 
value for money. We now need to consider the scrutiny capability of legislatures and 
how our reporting can help build it. 


Helping to Build Legislators’ Capability for Scrutiny 


It is Surprising how little the auditing profession discusses the capability, 
motivation and constraints of governing bodies to whom auditors report, or how their 
capability might be increased. It is as though the audit report, duly prepared and 
thought through, is to be left on a doorstep and what goes on behind the door should 
be none of the auditor’s business. 


To compound matters, legislative audit staff unfamiliar with the 60-hour 
work weeks of legislators are prone to have unfavourable stereotypes of them, which 
is perhaps worse than attributing too much capability to a governing body. If auditing 
is to serve accountability the audit office should try to help build the scrutiny capability 
of legislators. It can be done in ways beyond the short briefings that attach to those 
few audit reports a PAC chooses to deal with. It can be done significantly through 
audit reports that identify for legislators government’s obligation to answer for its 
prime management responsibilities, what those responsibilities are for accountability 
purposes and the important criteria that should be used for fair assessment. 


But there are some plain facts to consider. Each legislator has a 
formidable array of responsibilities to cope with daily, and they aren’t simple. Some 
issues in total are too complex for any legislator, given their existing staff resources. 
The issues tend to come at the legislator all together, in “information overload": at the 
federal level, free trade, abortion, Aboriginal land and autonomy claims, environment, 
whether nuclear submarines for a navy, major tax issues, bank acts, federal-provincial 
relations and on and on. Similar overload exists at the provincial and municipal 
levels: education, health care, property taxes, “down-loading” and other complex 
issues. The legislator must make complex trade-offs every day and try to grasp policy 
implications at both the legislative and program operation levels. Whose costs and 
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whose benefits are at stake? And what are those costs and benefits? The work time 
that elected representatives have is never enough, let alone to cope with both 
legislative duty and constituent expectations. A West Vancouver constituent of former 
federal PAC Chairman Ron Huntington, unconcerned about what his Member was 
trying to accomplish with his Public Accounts Committee work and as co-chairman of 
an important House committee on procedural reform, dismissed his Member's efforts 
in his riding with the terse comment: "He might as well not be there". The best 
legislators can do is try to cope. 


There is another problem. Few legislators have backgrounds fitting . 
them with an understanding of management and accountability in large complex 
organizations. Few can knowledgeably ask a newly appointed deputy head of a multi- 
billion-dollar federal agency, as PAC Vice-chairman Louis Desmarais did from his 
experience as a CEO of a major corporation: "What would you say are your most 
important management problems? What are you doing about them?" Fewer still 
would be able to deal knowledgeably with the range of possible responses. 


It may be argued that in the legislative-government process all elements 
are already in the "right balance" with respect to accountability -- that the level of 
legislator capability collectively is about what one should expect, and that the level of 
accountability by the government is all one can expect. And if this "balance" shouldn't 
be disturbed, then there is no need to discuss audit office opportunities to help 
improve legislator capability. But that hasn’t been the view of Members such as those 
already mentioned and the many others te have worked hard to improve the 
collective capability of MPs. 


There are further problems. Unseasoned legislators do not want to 
appear unskilled in committee meetings that are public, and thus may want to deal 
more with issues that have a potential and simple "blame" component. The 
legislator’s questioning and comments can then be picked up by a blame-oriented 
press aiming to sell more newspapers. This would be even more true at a city council 
level. But the elected representative needs to be seen to be at the centre of things, 
controlling the agenda, because of a public-exposure reward system too strong for 
many individual legislators to resist. On the other hand, there may be the thought 
that, except for election results, the legislator could be in the shoes of ministers or 
junior ministers being held to account in a goldfish bowl. This may be a partial 
explanation for why the PAC questions few ministers about their involvement in 
administration, for example the "ministerial override" issue. 


At a fundamental level, what legislators can conclude on expertly, and 
act on, is whether it should be management that reports on management's intended 
and actual achievement. At the federal level the Senate Finance Committee reached 
that conclusion in its 1989 review of comprehensive auditing. The legislator’s ability 
and motivation to hold to account depends on having a structure, framework or 
mechanism that helps clarify the more important scrutiny issues. Management's 
reporting can be expected to do this. 
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There has to be accountability for government management of public 
funds and resources. If management is not supplying the accounting, legislators 
need to be helped in their requests for it. Since there has been no legislation to date 
requiring the necessary management reporting and setting the reporting standards for 
completeness and fairness, holding to account has become, for legislators, an 
instance-by-instance activity. Yet for legislators to hold effectively to account at the 
government and program levels, they have to know what to ask for or what to ask 
about. Earlier it was noted that program audit scoping should take into account the 
views of legislature committees. 


If the PAC’s views about the audit office ranking differ, they can let the 
auditor know it at briefings for the PAC on audit planning. The audit reports reflect the 
responsibilities of government, including cross-government responsibilities and 
controls, in a manageable way for legislators’ scrutiny. The key is to concentrate on 
intended and actual accomplishment and the critical means of accomplishment -- 


critical success factors. The audit reports constitute, in a sense, teaching instruments 
for legislators. 


Consider programs. A major problem with the federal government's 
Part Ill Estimates, perhaps more important than the difficulty of reading them, is that 
they are usually couched in terms of activities rather than intended and actual 
accomplishment. Another weakness is that they are a description of entity operations, 


not government program responsibilities. Holding to account needs to concentrate 
on: 


e understanding the authorized and ranked intended program 
accomplishments of government, what it takes to achieve them and the 
rationale for decisions, 

the nature and quality of management control, 

the results actually achieved, 

the causes of the results, and 

what management learned, as a basis for its future action. 


It follows that the Crown should publicly identify the expectations it is 
honouring, in what priority, its perceived achievement responsibilities, rationale for 
decisions and performance standards, and report its actual performance, explanations 
of variance and its learning. 


If management does not report on these, the auditor should point out, 
for each of management'’s important responsibilities not accounted for, the types of 
management assertions needed. The legislative auditor then has a choice whether to 
stop there and expect the legislature to put things right, or try, within the available 
audit resources and through the audit report, to give legislators the assertions that the 
auditor thinks management could make for each important responsibility. This would 
constitute direct audit reporting on performance criteria that are clear in the audit 
report. The example of Crown corporation special examinations shows that a start 
has been made and that much can be done. To argue that this is too difficult to 
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comprehend at the level of government as a whole is to argue that the legislative 
auditor’s knowledge and insight needn’t be as much as that of a legislator with less 
than‘five year’s experience who has a scrutiny duty for the whole of government. 


The point is not how perfect the audit office assessment has to be, but 
how useful. Auditors aren’t asked for the impossible. The deficiency reporting 
approach, of course, eliminates the need to comprehend the whole of government’s 
efforts in its context. The question is simply how much help the auditor wants to 
provide, while staying away from assessing the merits of policy. 


The legislative auditor has to distinguish between legislators’ wants and 
legislators’ needs. "Wants" as defined here refers to having the auditor offer 
something that could get press ("ink") but which may not be central to fair assessment 
of government. But by saying that our job is only to supply what legislators "want", 
the auditor can keep on doing what's easiest: reporting only deficiencies. Producing 
what legislators need most for fair scrutiny requires a Knowledge of control in complex 
organizations, and knowledge of the questions such a governing body should usefully 
ask in a non-partisan role. What we do know, provincially and federally, is that 
legislators may be able to answer the question put to them "In audit reports, would 
you like x?" But by and large they can’t tell us what they need for non-partisan 
scrutiny. , 


There is more than one way for management to report on its 
responsibilities for accountability. One approach is to report on management 
objectives and the critical success factors for each. Another is to adopt a standard 
set of performaiice dimensions and report on each. They needn’t be mutually 
exclusive. Canada Mortgage and Housing Corporation, for example, used both. An 
example of the first would be a framework of specific intended achievements and the 
functions or sub-objectives needed to produce them, which we can call the critical 
success factors. Both the intended achievements and the critical success factors can 
be ranked in the reporting. 


A multiple-dimension approach is proposed in the framework set out in 
the 1987 study on effectiveness reporting and auditing by the Canadian 
Comprehensive Auditing Foundation. The CCAF’s proposed framework sets out 12 
basic dimensions of performance or “attributes” to be reported on. These include 
results, how well the organization is directed, the levels and types of effort, the extent 
to which its work is accepted, and the several others. Management’s reporting on 
each of the 12 attributes would include rationale for the important choices made by 
management in each area of effectiveness. For the governing body it is meant to be 
an all-encompassing organizing and summarizing framework for reporting on 
management’s responsibilities. The attributes can be applied to review of a particular 
program, to the extent that each individual attribute is relevant to oversight of the 
particular program. It was used by CMHC management as a basis for reporting to the 
Board, and for the external special examiner’s opinion. It has also been used by units 
of the Manitoba and Quebec governments. 
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In view of the importance of programs as the accountability focus, the 
program-related committees of legislatures need help to do a more effective job of 
scrutiny. This paper cannot deal with this service issue at length. Suffice it to say that 
the audit report should help those committees develop their ability to scrutinize fairly. 


The Role of External Audit 


Audit is not intended to do the job of either management or the 
governing body. As a process, any audit is the independent assessment of behaviour 
of interest against standards or criteria and the reporting of the assessment to a third 
party, the client of the audit. Audit serves the accountability relationship but stands 
outside it. That is what “external” audit means; the auditor is not part of the 
accountability relationship. The legislative auditor therefore does not hold 
management to account on behalf of the legislature or taxpayers. 


Since it is the governing body that holds management to account, the 
standards or audit criteria should be those of the governing body. If the governing 
body has not produced them, the auditor identifies what he or she thinks the 
governing body in its circumstances should need to hold fairly to account. The 
starting point for developing criteria is to identify those that reflect the auditor’s 
understanding of what the governing body actually expects of management explicitly 
or tacitly, e.g. what the legislature expects of government management and what 
ministers and central agencies expect of departmental and agency management, to 
the extent this is discernible. The role of the auditor is to say to the governing body: 
“Using what we think are the criteria most important to you in your role, this is what 
we see going on, as best we can determine. Is it what you had in mind?" 


The real key to accountability is the question "Is this what you had in 
mind?” It helps make visible the governing body’s actual expectations of 
management in the accountability relationship, for all to see. Governing bodies are 
accountable also. The question invites the governing body to respond; in other 
words, to act in its oversight duty. Those who hold the governing body to account 
must then assess its action or inaction. The reason the legislative auditor in the direct 
reporting role has to do management’s job of reporting on performance was noted 
earlier: legislation doesn’t ask government management to account. The legislative 
auditor in these circumstances has to ensure that the legislature gets at least some of 
the important information it should have to hold government to account. The problem 
is that so long as the auditor continues to do management's job, the accountability 
relationship will remain stunted and the governing body will not itself feel accountable 
for the quality of management’s reporting. When management reports, the governing 
body has to react in a responsible way or risk damaging the accountability 
relationship. 


* We are indebted to Hector Millward for this fundamental question. 
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Commonsense Interpretation of Legislated Audit Mandates 


Sea Training Officers, overseeing naval officer cadets learning their 
pilotage as the ship steams along the coastline, are fond of springing on an 
unsuspecting cadet the sudden command "Get your head off the chart table and see 
where you’re going!" VFM auditors can get equally engrossed in Auditor General Act 
sub-divisions and fail to keep in mind the essential direction of the Act, its spirit: to 
report what is most useful to the legislature holding fairly to account. This is why a 
senior member of the profession, as a member of the Auditor General’s Independent 
Advisory Committee, said: "First read an Act with common sense”. 


The commonsense way to go about interpreting an audit mandate to 
reason out what the auditor should provide to the legislature to improve its ability to 
hold to account, and then look to the audit Act to see if there are problems in 
delivering what is most useful. Being fair to management, avoiding unnecessary 
perceptions of "negativism’ in audit reports, and providing the legislature with useful 
audit information on management’s prime responsibilities can all be accommodated 
by commonsense interpretations of audit legislation. When legislative auditors report 
whether management met important criteria, they get a positive reaction from 
legislators. 


In the federal Auditor General Act, for example, the lead-off instruction 
under Section 7(2) states that the Auditor General in his annual Report "shall call 
attention to anything he considers to be of significance and of a nature that should be 
brought to the attention of the House of Commons..." It goes on to say "including any 
cases in which he has observed that...". In the Ontario Audit Act a similar "of 
significance" lead-off statement is followed by a "not restricting the generality of the 
foregoing" phrase, often found in legislation, which is implicit in the federal AG Act. 
Thus the main charge to the legislative auditor is the essence of common sense: 
"Report to the legislature whatever you deem to be of significance to the legislature”. 
This of course doesn’t mean reporting on the merits of policy. “Of a nature" is not 
found in the provincial audit Acts, presumably because it isn’t necessary. For 
example, "of significance” would cover the case of an auditor general not reporting 
something that would compromise government security, since "of significance" applies 
to what the AG deems the legislature ought to know about for its public non-partisan 
scrutiny role. If “of a nature" weren’t in the federal Act no one would miss it. The 
provinces obviously don’t. 


As a matter of common sense, the four corners of 7(2) sub-sections (a) 
to (e) in the federal audit Act are not the main driving instruction to the Auditor 
General: they are best thought of as a minimum reporting checklist to provide 
significant illustrative examples when fair criteria aren’t met. They say, “And if you find 
deficiencies of this type that are significant, be sure to report them.” 


Auditors may have gravitated to the notion of reporting only deficiencies 


for a number of reasons. First, sub-sections (a) to (e) sound specific. Auditors have 
a tendency to seek specificity in direction ("just tell me the Handbook rule"), especially 
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when it is a new area of scope like VFM. Secondly, auditors may tend to prefer 
reporting deficiencies because it attracts more media attention to their work. Thirdly, 
audit assurance is easier to build for a deficiency finding conceded by management 
than for a finding that management met an important criterion. 


In the Ontario audit office, with essentially the same audit legislation as 
the federal, the Provincial Auditor, Douglas Archer, took the position publicly in his 
Reports that to be of most use to the legislature he needed to go beyond reporting 
deficiencies only, to report assessments of management’s administration of sets of 
important responsibilities. He found that the Ontario legislators welcomed his 
decision. The Office of the Auditor General of British Columbia took this position from 
the outset of its VFM mandate. As needs evolve, the interpretation of legislation 
needs to keep pace. 


The latitude in the "of significance" sections of audit Acts is purposeful; 
it is up to the legislative auditor to deem what is significant to the legislature. It is also 
logical. What should be important to a governing body for its scrutiny decision 
making is whether management met the most important criteria in its most important 
responsibilities. Put another way, if management met an important criterion, shouldn’t 
the legislature know it? The governing body wants to reduce its uncertainty about the 
discharge of important management responsibilities. 


If we recall the "nothing said, all’s well" problem, providing only 
deficiency findings doesn’t reduce the uncertainty unless the auditor states that all 
other important criteria were met. In department and agency audits, reporting 
deficiencies only, rather than reporting whether important criteria were met, fails to tell 
the governing body anything beyond the deficiency observations. And frequently the 
report describes only our scope for the deficiency findings, rather than the scope used 
for the audit. In Crown corporation special examinations, the auditor’s opinion must 
cover off all important systems and practices of the corporation. No one would say 
that this requirement is undesirable for the governing body of an organization. 


Emphasizing deficiency instances, rather than reporting whether 
management met important criteria, leads the junior auditor into fishing expeditions for 
deficiencies rather than an attempt to understand the main responsibilities of the 
audited organization, their ranking and the accountability reporting it should be 
providing. Review of the ten-year evolution of VFM reporting during the CCAF 
Reporting Study showed movement away from the reporting of deficiencies only. 


The federal Auditor General Act rightly does not dictate or limit the 
range of matters that the Auditor General is to deem significant to the House. 
Significant matters include not only those audit observations the AG thinks the House 
should know about, but also audit office studies on important issues. They also 
include the Auditor General’s own annual sum-up observations in applying his 
professional judgment to patterns he observes from cumulative audit findings. The 
obvious example is the outspokenness of all auditors general in Canada on the quality 
of accountability reporting to the legislatures. 
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Departmental and Crown Corporation VFM Auditing 


This paper argues that it is not helpful to regard audits of government- 
owned corporations as conceptually different from departmental and agency audits. 
As noted earlier, Part X of the federal Financial Administration Act (FAA) specifically 
requires Crown corporations to have systems and practices in place that ensure 
delivery of economy, efficiency and effectiveness in the corporation’s operations. 
Note that this is an instruction for results: the systems and practices must be such 
that the result meets a standard of due regard to value for money. For ministries and 
agencies there are no parallel provisions in the FAAs in Canada, asking for the same 
performance standard. But that doesn’t mean that the concept of identifying and 
reporting on management's most important control responsibilities should be different 
for departmental audits. Moreover, the Crown corporation reporting section in the 
FAA is open-ended in the types of responsibilities on which the corporation is 
encouraged to report: the section need not be read as confined to financial 
performance. 


In the special examination scope for federal Crown corporations, no 
area of operations is excluded. The FAA in effect requires the special examiner (the 
VFM auditor with a different name) to report whether, in the auditor’s view, for the 
corporation as a whole, there are significant deficiencies in the systems and practices 
required by Part X -- the systems and practices that deliver value for money. By the 
wording of the Act, all basic determinants of the asked-for performance are included: 
motivation, organization structure and managerial ability -- the lot. It is implicit that the 
responsibilities are those that management can control. 


The level of audit assurance is the corporate level. This makes sense 
for the governing body. Reviewing the proposed audit with the board helps ensure 
that the most important management responsibilities are included in the scope, within 
audit cost-effectiveness limits. There are obvious limits to the competence of special 
examiners in what they can knowledgeably report to help a board with matters such 
as motivation systems and appropriateness of organization structures and re- 
organizations. A safety net is provided in the audit reporting section of Part X. The 
auditor reports on the audit criteria reviewed with the board. Boards are not going to 
expect audit examinations beyond the state of the art, so the audit criteria will be 
within the auditor’s competence. What boards increasingly have the right to expect is 
that auditors will expand their competence: that they will understand management 
control processes. Hence the emphasis placed in the CCAF’s Reporting Study, on 
good mutual understanding between the auditor and the governing body on audit 
options and limits, and the level of audit assurance. The legislative auditor would not 
be expected to report on the government as a whole. 


Unlike the federal FAA provisions for VFM audits of Crown corporations, 
audit Acts for auditors general do not set out the audit scope. But, as argued earlier, 
there is nothing in the federal Auditor General Act that asks that the objective of 
departmental program audit reporting be different from what legislation says is useful 
for the governing bodies of Crown corporations. The approach to auditing and 
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reporting that has been legislated for federal Crown corporations is accountability- 
based auditing. 


The question that needs to be dealt with is why accountability-based 
auditing and reporting, deemed sound for management responsibilities in 
corporations, is argued to be conceptually inappropriate for other government 
organizations. The famous turn-of-the-century psychologist William James, 
commenting on rigour in experimentation said: "A difference that makes no difference 
is no difference." Some say that the Section 7 work under the AG Act is to determine 
whether value for money is achieved, while Crown corporation special examinations 
deal “only with systems and practices" -- even though the corporate achievement 
comes from the sum of the systems and practices. Others say that “it’s different 
because the legislation is worded differently." We have yet to show how these 
asserted differences make a difference to what the auditor should be doing to be 
most useful to a governing body in its scrutiny role. 


Some will say that the cost of reporting whether departmental 
management demonstrated due regard for its most important responsibilities (the 
Crown corporation audit reporting) would be too great for departments and agencies. 
Others deny that resource constraints are real external constraints, because in every 
situation of resource limitations in organizations the answer is the same: to rank, and 
to get approval of the ranking and the rationale. 


One real difference between the two audits is that, in the Crown 
corporation VFM audit, the management responsibilities to be scoped in are first 
reviewed with the board or its audit committee. Rarely is there such an "engagement" 
meeting with legislators in departmental auditing. As noted earlier, audit legislation 
leaves to the legislative auditor of departments and agencies the decision on what 
scope will best serve non-partisan scrutiny by the legislature. However, the scoping 
rationale should be set out in the audit report to the legislature. There is nothing to 
stop legislative auditors from taking the initiative and fully briefing public accounts 
committees, and departmentally-related committees too, on their audit scope and 
asking what rankings they have in mind, so long as the legislative auditor is satisfied 
that the rankings are not partisan. 


A Recommended Approach to Direct Auditing and Reporting 


Comprehensive audit scope should cover those management 
responsibilities that the auditor thinks are central to the governing body’s review of 
management's performance. This applies whether or not management is reporting on 
its performance. As noted earlier, responsibilities scoped in can be those decided at 
the auditor’s discretion or those asked for by the client governing body, or both. The 
scope statement in the audit report should make clear what management 
responsibilities are included in the scope and the rationale for their inclusion. Since 
governing bodies need to know about compliance, resource safeguarding, VFM and 
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reporting adequacy, these become audit criteria areas for the management 
responsibilities scoped in. 


We identified two sets of options for the direct reporting role. The first 
is the choice to report on a deficiency basis or an accountability basis. But within the 
accountability basis, it is possible either to scope in those management 
responsibilities that the auditor thinks should be most important to the legislature’s 
scrutiny, or scope in a "selection" or sample of management responsibilities. These 
will be deemed by the auditor to be important, but are not asserted to be the most 
important responsibilities or to be those that result from a continual process of re-. 
ranking the responsibilities of a program or entity or whole set of government 
programs. They may, for example, reflect the auditor's own background interest or 
special competence -- or staff availability. In each case the responsibilities may have 
to be covered off over time -- a reasonable time -- on a cyclical basis, because of 
annual audit budget limits and logistics. 


The difference is that concern about risk in a responsibility-ranking 
approach will always centre on the most important responsibilities and the systems, 
practices or critical functions the auditor deems most important for the intended 
management accomplishment. As defined above, the "selection" approach is open to 
the auditor's personal preference in aspects such as areas of available audit 
competence or administrative convenience, and would include the goal of seeking 
something significantly deficient to report. 

Within the auditor’s direct reporting role, there are thus four possible 
approaches to scoping: scoping in either "selected" or ranked responsibilities, each 
with a reporting objective that can be either deficiency-based or accountability-based. 
Let us briefly consider each of the options in turn. 


Scoping in selected management responsibilities but reporting only 
deficiencies allows the scoping to be fitted to the Office’s existing resources, and to 
the individual auditor’s preferred or functional interests. It also supports the concept 
of "matters of potential significance" as the search for deficiencies only: the audit and 
reporting objective is to report deficiencies, which the House and media are expected 
to notice and deal with in their own way. However, it creates the most severe 
interpretation problem for report readers. This is the so-called “assurance” issue, 
which is the risk that the report user infers conclusions that the auditor did not intend: 
the intended message doesn’t match the message taken away by the reader. In 
short, this approach to scoping does not deal with the "nothing said, all’s well" 
problem and has the least rigour in adequacy of coverage of key management 
responsibilities. It would also have the lowest rating by audited management on 
fairness of the reporting. If the described audit scope is limited to the deficiency 
areas, the reader is still left wondering what the extent of the auditor’s review was. 
Legislators cannot be expected to know the difference between “survey” and “audit”. 


Scoping in management’s most important responsibilities but reporting 
only deficiencies represents auditing that addresses the most important management 
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responsibilities from a point of view of risk to the public purse, and reports on a 
management-by-exception basis. The "nothing said, all’s well" issue is assumed not 
to be a problem for the legislators, a shaky assumption. This approach does not 
meet the Macdonald Commission’s expectation that the auditor should report 


whatever he or she knows that has a strong possibility of being significant to report 
users’ decision making. 


There is a difference between taking higher audit risk to cut VFM audit 
costs, and creating risk that the governing body will wrongly infer something from the 


audit report. The latter may be more risky to the VFM auditor’s longer-run credibility 
than the former. 


The two deficiency-emphasis approaches create the following problems 
that collectively hinder the building of effective accountability relationships: 


e The reporting of deficiencies only is unfair to management. This cannot 
lead to greater management co-operation with the auditor but it could 
be expected to lead to less. 


e It is a piecemeal approach not designed to build legislators’ knowledge 
and capability and does not enhance accountability. 


e When scope is "selected" it gives insufficient attention to major 
management responsibilities not scoped into the audit. 


e It creates problems for the governing body in understanding the scope 
of the audit. Describing the scope only for the areas found deficient 
compounds the problem. 


® Because it involves important self-imposed limits on scope, some may 
argue that it is not auditing -- only "investigative reporting’. Certain 
management responsibilities may be so important that they cannot be 
left at the survey level of rigour unless the survey work constitutes an 
audit. An audit does not exist if it is not reported. 


e An approach that says "we are basically looking for deficiencies but 
we'll throw in some balancing positives” is not a professional audit 
approach. 


The deficiency emphasis is not logically compatible with the objective of 
serving the decision-information needs of governing bodies holding management fairly 
to account. While it is fully compatible with a “deterrence only" audit objective, the 
concept of deterrence is the opposite of the concept of accountability. What most 
auditors general in the past decade have written about more consistently than any 
other single issue is the need to enhance accountability. Deterrence is like 
punishment: it says what not to do but fails to say what one should do. 
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For "selected" scope areas, accountability-based audit should deal with 


management fairly: if management met the audit criteria, it will be reported. But in 
the scoping decision there can be some "stacking of the deck" on the side of 
probable deficiency findings. "Whether" is only as complete as the scope allows it to 
be. If the scope is biased toward finding significant deficiencies it is in effect 
deficiency-based auditing, not accountability-based. 


Auditing that scopes in management’s prime responsibilities and 


reports whether management met the most important audit criteria has the following 


benefits: 


It makes legislators aware of those management responsibilities the 
auditor thinks are important enough to be covered by audit, from a 
legislative accountability standpoint. It thus has a teaching benefit for 
legislators who do not have backgrounds in management of large 
complex organizations. 


lt draws to the legislator’s attention the fact that management met 
important criteria, whenever that is the case, which helps to increase 
the legislator’s respect for management, and thus taxpayers’ confidence 
in government management. It is the only audit approach likely to be 
judged fair to managers. 


It causes management, if it agrees with the scope ranking from an 
accountability standpoint, to concede that the auditor knows the 
business of the audited organization or program and the important 
management responsibilities. Coupled with the fairness of the 
approach of reporting when criteria were met, it increases the auditor’s 
credibility with management. The consequent increase in 
management's fairness and competence trust in the auditor fosters 
greater management disclosure to auditors of matters relevant to 
assessing its performance. 


It deals with the "nothing said, all’s well" issue by ranking 
management’s responsibilities and making it clear that, although the 
audit won’t likely cover all of them, it will cover those the auditor deems 
to be the most important at the time from a standpoint of accountability 
for accomplishment. For example, at the time of the launch or proposal 
of an important government program, the quality of the intended 
accountability reporting on performance would be a major audit 
concern. Management control processes have to be assured and 
reported on, and there has to be in mind the means of later evaluating 
its effectiveness. This is quite apart from the merits of the program 
policy or subsequent compliance, but the audit concern for 
accountability anticipates legislators’ later concerns. 
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e This reporting can form the basis for overall assessments; none of the 
other approaches can. That is one reason why Crawn corporation 
special examinations are of this type. 


e It does introduce, for legislative auditing, higher risk of missing an 
important responsibility because the reporting is implicitly asserting 
auditor competence in ranking, and adequate scope. But this is what 
audit advisory committees are for. If a particular set of important 
management responsibilities and processes is too complex for the 
auditor, or for the outside expertise available, the reason for the scope 
limitation can be explained by the auditor -- without apology. The fact 
remains that the risk of a scope omission is not a deciding factor; it is a 
professional risk all auditors take, in both public and private sectors. 


Although the above approaches are set out primarily to fit the VFM 
direct reporting role, they apply also to VFM attest audit when management makes 
the performance assertions rather than the auditor. The 1989 special examination of 
CMHC is an example. 


Management’s accountability reporting is also part of management’s 
performance. The criteria for fairness and completeness are assembled from 
common sense and from private sector standards for attest audit. There are a 
number of ways to approach it, but the audit message on the quality of 
management's reporting can be fairly simple. One is to couch the assessment almost 
as surprise. To emphasize management's duty, the audit observation could be of the 
form: "We would have expected management to have reported on its responsibilities 
x,y and z. The reporting on x and y reasonably serves the accountability relationship. 
Management did not report on z, so we have to." The more we report in this manner 
the more the governing body is likely to say to management, "Why don’t you report?" 
The same is true for internal audit’s reporting. Internal audit first needs to sort out the 
accountabilities and then help encourage management to report on them. 


Accountability-based Compliance and Financial Attest Auditing 


The idea of comprehensive auditing is that the scope components, 
taken together, cover off the most important management responsibilities in an 
accountability relationship. The basic issue in legislative compliance is “did you do 
what you were asked to do?" It is arguable that compliance, not VFM, is still the 
cornerstone of legislative auditing because of the scope it can imply. The distinction 
between a legitimate performance expectation and a directive is often blurred. The 
basic financial attest audit issue is “Does the reporting fairly reflect the discharge of 
responsibilities?" 


Compliance. The audit of compliance goes beyond compliance with 


the legislation-based authority for the expenditure, collection and borrowing of money. 
Compliance auditing in the broadest sense relates to management control processes. 
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As Robert Anthony put it, are managers doing what top management wants them to 
do? But this broad view of compliance -- as an outcome of motivation and other 
factors -- has not been the view generally held by auditors and central agencies, 
oriented to spending within limits and following directives. The spirit of the 
government’s PS2000 effort is really about the need to change from a negative to a 
positive view of control, and changing the procedures and risk-taking that allows it. 
This paper cannot encompass that issue: here we will talk about compliance in the 
more specific sense, as conformity with a legitimate authoritative expectation. 


Management’s external accountability reporting is reporting on 
performance, on what people actually do in view of expectations -- whether it is 
described as compliance, VFM or financial reporting. Whereas the CCAF’s 
Effectiveness Reporting study left behind the compartmentalized three-component 
view of economy, efficiency and effectiveness and re-cast accountability in terms of 12 
general attributes of performance, no similar work has been done to sort out the 
concept of management’s accountability reporting for compliance. The CCAF study 
did not deal with the subject of compliance as such, even though it could be argued 
that it should have been the 13th attribute. 


Compliance is, first of all, compliance with an expectation. But 
economy, efficiency and effectiveness are also expectations. So why isn’t 
effectiveness a compliance issue, if departments and agencies are specifically voted 
funds not for activity but to accomplish certain program objectives? We might then 
say that compliance means meeting a certain class of expectations that are so 
specific that management discretion is largely precluded, or at least clearly 
constrained. This applies whether it is legislation that dictates purposes and limits of 
spending, or policy authorities such as Crown directives. 


Perhaps the easiest way to make the audit of compliance manageable 
is to view it as being of two broad types. Compliance with legislative authority means 
that the Crown is complying with the spirit of a directive external to management, one 
that comes from the legislature. It involves the purpose of spending as well as dollar 
limits for collecting or borrowing money, but the authorizing legislation may specify a 
“how to" as well; that is, it may specify a management control requirement. 
Management control objectives include compliance both with legislative authority and 
with executive orders not directly stemming from a specific objective in a piece of 
legislation. Ultimately all government action flows from broad legislative authorization, 
since it is possible to say that everything can ultimately be stated in terms of 
spending, collecting or borrowing money. There is a hierarchy of authority that can 
be viewed as a legal hierarchy, but there must also be discretion in operational 
decision making. The audit of compliance leads upward to validate the authority for 
a management action, and back downward to assess faithfulness to the intent of the 


higher authority and the adequacy of management control processes to deliver on the 
expectation. 


Thus management control -- that is, managers ensuring achievement of 
what top management wants them to achieve -- embraces all intended compliance. 
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Measures for executive compliance with legislative authority are, for practical 
purposes, part of management control. When the origin of the direction is Parliament, 
the quality of the management controls should reflect the importance of that fact. 


What about compliance and VFM if, say, adhering to the provisions of 
an obviously outdated Act or regulation wouldn’t serve VFM? Standards of 
compliance, in terms of both management’s reporting and audit reporting, have to be 
interpreted realistically within the spirit of the most authoritative intent in current 
circumstances. In other words, we are back to the issue of management’s prime 
responsibilities, some of which may be to comply with specific external instructions 
rather than take discretionary action. When there is a problem, the manager informs 
the authority of the management intention and sees if there is agreement -- or finds a 
way to do it within the directive. A main difference between the public and private 
sectors is the relative amounts of management discretion: high management 
discretion in the private sector, with a relatively clear performance measure 
(sustainability of cash flow), and lower perceived discretion in public service 
management, with relatively unclear performance measures. 


Another audit issue is identifying the ultimate authority itself and the true 
spirit of intent emanating from that prime authority. That is, authority from whom, and 
for what? Here we get into the important issue of purposeful latitude in policy and the 
real intent of the body or bodies entitled to decide what "value" is. The legislative 
auditor has to be able to recognize intended latitude in the definition of value, as well 
as needed adherence to regulations. The official regulations may, in fact, be simply 
window-dressing for a purposeful "throw money at it" operation, or be inappropriate for 
an expenditure whose controls are purposefully loose to achieve genuinely expected 
maximum value. The auditor first has to know what’s intended at the policy level. 


When the legislative auditor reports: "This is what seems to be going 
on; is it what you had in mind?" the level of the "going on" has to be at the highest 
level to be useful to a governing body. Grants and contributions policy is a major 
example. Another might be intentionally loose Treasury Board controls over a vast 
self-learning experience across government in producing the best use of 
microcomputers. Understanding purposeful latitude and appropriate reporting for fair 
accountability needs to be worked on as a research study for legislative audit, which 
means that it would include study of auditors’ ability to "let go" their fixation on 
“centralization” and "documentation", as more useful motivation-based concepts of 
management control are developed. 


For government’s compliance reporting, compliance with the authorized 
purpose for spending can’t be summed up to a total dollar figure in financial 
statements that will mean something to a reader concerned with performance 
accountability. How does one sum up the effects of spending for unauthorized 
purposes as opposed to the dollar amount of overruns on vote totals? The answer for 
the compliance report in the federal government’s external summary financial 
reporting was the Treasury Board decision a few years ago to delete the report: 
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perhaps a classic case of the old facetious audit maxim "If in doubt, leave it out". This 
hasn't solved the problem of management’s accountability reporting on compliance. 


It is a fair question whether legislators, seeing an audit opinion on a set 
of government financial statements, would regard the opinion as covering 
government’s compliance with authorities not only for dollar limits but also for 
purpose. And do Management Reports attached to government summary financial 
statements assert that reasonable standards of compliance were actually met in all 
material respects? 


The absence of government reporting on its responsibility for 
compliance with authority has tended to create an "orphan" of compliance auditing in 
audit work. It needs to be sorted out by applying an understanding of accountability 
and management control. To say that compliance audit work is to be "embedded" in 
financial attest and VFM audits does not solve the problem. Another problem on the 
audit side is how a particular management responsibility for compliance, important for 
management’s overall accountability in its own right, would get scoped in if authority 
audit work were derived only out of scoping for VFM or financial attest considerations. 


The question of the relationship between compliance and value for 
money has not yet been resolved. Until we identify wnat should be reported for 
accountability we won’t know what should be significant information for legislators’ 
assessment of performance. Many VFM findings can be couched in compliance 
terms, for example the OAG finding several years ago that federal airport managers 
were not producing VFM, in part because they were not recovering the costs they had 
been told to recover. 


Financial attest. The fact that a Financial Administration Act requires a 
balance sheet, a spending and revenue statement and other statements, in a form 
government is to determine, doesn’t necessarily produce the decision information 
needed by a legislature for accountability. Given that the prime function of external 
reporting is accountability, the assessment of the adequacy of government's external 
financial reporting is only one segment of the total performance reporting needed. 
But it must deal with the question of accountability by wnom, to whom, for what, and 
the decision needs of the prime entitled users. 


The question to be asked about financial reporting is: accountability for 
what performance? Is the reporting to account in financial terms for compliance and 
for regard to value for money, or is it to account for "financial performance"? And 
what does financial performance mean for a government? Is it actuals to budget? If 
so, is the budget better as cash or as accruals? Are the accruals meaningful for 
decision-making that is largely a matter of opportunity costs? Or is it the deficit? If 
so, how should the deficit be calculated for the most useful performance assessment? 
What does a deficit figure really mean, for legislative decision making that essentially 
commits cash resources, incurs opportunity costs and results in taxing? What assets 
as well as liabilities would need to be recognized in determining a deficit, and why? 
Are fixed assets and depreciation based on historical cost in a public sector balance 
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sheet meaningful for anyone’s decision making? In legislative auditing we don’t yet 
have good answers to these questions to help produce the best possible 
recommendations for improving performance reporting in financial terms. 


We have yet to orient our thinking around the notion of integrated total 
accountability reporting by government on its performance, in a form that is tailored to 
legislators’ specific decision making needs in their specific roles of performance 
scrutiny. How should the various types of reporting be integrated? !n the area of 
financial reporting, fairness and completeness of the reporting should relate to 
government management’s most important responsibilities. The government's 
financial statements shouldn’t be simply a compendium of data, or a grand edifice in 
their own right, simply patterned largely on a private sector model. That model 
comprises a set of conventions developed over time to measure annual earnings per 
share, and is based on a concept of matching costs and revenues under accrual 
conventions based on merchandising and manufacturing operations. None of this 
has ever applied to the public sector. We need a conference on it, for a start. 


As an example of problems in performance reporting, we can again use 
the government’s responsibilities for protecting the environment. University of Dundee 
professor R.H. Gray’s 1990 report "The Greening of Accountancy: the Profession After 
Pearce" notes, from the U.K. government’s Pearce Report, that sustainable 
development requires identification of both environmental capital and man-made 
capital, and requires public accounting for diminutions in the environmental capital. 
Professor Gray divides environmental capital into "critical" and "other" capital and 
notes that allowing no diminution in critical capital will cause diminution in man-made 
capital. 


The point to infer from professor Gray’s assessment is that 
governments will need to account in some way for the total environmental capital, so 
as to disclose their performance in protecting the environment. The right performance 
measures for stewardship will flow from expert knowledge of needed programs and 
their critical success factors. They will not flow from trying to fit environmental 
accountability issues into generally accepted accounting principles for the private 
sector. It is the job of management accountants to help management develop the 
performance measures, if they will take the opportunity, and for attest auditors to 
assess the completeness and fairness of the performance reports. Accounting for 
environmental accountability will have to be looked at in new ways for government 
sector responsibilities, and likely for private sector accountability as well. 


The problem in the public sector is that the main elements of 
performance concern -- compliance, VFM and financial -- have never been brought 
together in a unified or at least internally complementary set of performance reports. 
Financial reporting needs to be regarded as an element of accountability reporting on 
management performance, designed for specific governing body decision making. 
The most useful content has to be sorted out in the right forums. Right now as a 
profession we are unable to assert without challenge that we are delivering value for 
money from the resources we now spend on financial attest audit in the public sector. 
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Reporting compliance with authorities (for both the nature of spending 
and the amounts), reporting due regard to VFM and financial reporting need to be 
integrated by the best thinking into a set of reports on management performance that 
is useful for legislators decision making. Until then, legislators will lose something. 
Moreover, staff will remain confused about these reporting inter-relationships and 
therefore the connections between them for audit scoping and reporting. If we know 
what reporting is most useful for what types of legislator decisions, we will Know what 
to set out to report on, in audit reports that serve accountability. 


Implications for Auditors’ Capability 


The implications of accountability-based auditing and reporting are 
important for the practice of legislative auditing. If we are to be useful to legislators 
we first have to be trained to put ourselves in their shoes in the role of non-partisan 
scrutiny, and understand what they ought to have in information to hold government 
fairly to account for its management of public resources. What we do know by now is 
that they can’t tell us. As noted earlier, elected representatives all suffer from 
information overload and few have the background in management and accountability 
processes in large complex organizations to specify the information they need for 
scrutiny. Equally, we have to be able to put ourselves in the shoes of management of 
large complex organizations and see the problems of control from their point of view. 


This immediately raises the issue of standards for staff competence. 
Some of these were suggested earlier, in the section on management control. To 
serve a legislature properly we have to have the competence to know what fair 
performance and accountability expectations are for management of different 
government agencies in different circumstances. We have to understand 
management processes and their causes and effects, and know what processes are 
involved to make an effective accountability relationship. We have to know, from the 
viewpoint of the governing body and the public, what should constitute practical, fair 
and effective accountability in particular circumstances. And we have to understand 
which approach to legislative auditing is most useful in serving the needs of particular 
governing bodies, such as legislatures and boards, in holding fairly to account. 


Management cannot be held to account for what it cannot control. This 
means that practical expectations of management performance must be centred on 
due regard by management to achieving value for money when external constraints 
on managers may prevent its achievement. How well do we understand managers’ 
real constraints? We have to understand the strength of barriers standing in the way 
of improved management in the public service and how the constraints operate, and 
be unafraid to comment on them regardless of who or what is causing them 
(ministerial override, for example). 


In auditing and reporting that serves accountability, the legislative 
auditor's orientation is to three areas of management responsibility: 
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- what management plans to achieve within its authorized mandate and 
constraints, and what the performance standards are to achieve it; 


how well it controls the deployment of ability and effort, deals with 
external constraints and learns; and 


: how well it accounts for (reports on) its achievement intentions and the 
discharge of its responsibilities. 


The central concern is whether the quality of management planning, 
control and external reporting meets standards for due regard that are reasonable to 
expect in management’s circumstances. To identify and report on causes and effects, 
auditors need to understand and distinguish, to the extent reasonable to expect from 
legislative auditors, management control processes and the effects of basic 
determinants of performance such as ability, motivation, organization structure, 
information and external constraints. 


Achieved results are important to auditors for what they say about 
management's regard to compliance, safeguarding of resources, VFM and reporting © 
and the quality of its management control. But reporting the results should be 
management's job and it is the governing body’s job to exact the reporting of results 
and explanations by those accountable. So we must also understand the 
determinants of the governing body’s capability and motivation, whether legislators or 
corporate board members, and identify ways to increase them. 


Since the scope of the legislature’s scrutiny includes the entire 
government, the scope of the legislative auditor's concerns in serving the legislature 
also includes the entire government. Since programs are not confined to single 
departments, the legislative auditor has to be able to deal with programs as 
government programs, and rank them for their significance to the public purse and 
legislators’ expectations of results, rather than work only within the confines of a 
department that shares in the delivery responsibilities. 


Note that all of the foregoing issues arise whether the auditor is 
attesting to the fairness and completeness of management’s accountability reporting 
or assessing management direct against fair performance and reporting criteria. 
Specifically, we need to improve our understanding of management control processes 
that produce performance and accountability in government. Staff who claim to be 
expert in something have to demonstrate their background in it. More broadly, we 
need to identify the body of knowledge needed to serve the accountability 
expectations emerging in this next decade, and to identify the training needs it 
implies. 
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Conclusion 


So long as management doesn’t report, it is not being held to account. 
That fact has to be faced and the legislative auditor can’t control it. It is clear, under a 
commonsense interpretation of a legislative auditor's duty to a legislature, that if 
management is not asked to report and doesn’t, the auditor will have to report direct 
on management’s discharge of its prime responsibilities. But so long as the auditor is 
forced to stay in the direct reporting role, the reporting of deficiencies only will be 
found to be something that is unfair to management, doesn’t build accountability and 
simply perpetuates a ritual dance of findings and public blamings. 


Direct auditing and reporting that is accountability-based has at least a 
chance of helping to improve accountability until the public, through the help of public 
interest groups, learns to ask accountable governing bodies to ask management to 
report, and until the consequent management reporting brings about a more effective 
accountability relationship. We have an opportunity to encourage governing bodies to 
require the most useful accountability reporting from management. Without losing our 
independence, we can help management devise the reporting. 
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